Re: Goal / Danger: Attack by malicious root

[Bennett Todd <bet@rahul.net>]

[-- Attachment #1: Type: text/plain, Size: 1366 bytes --]

2001-01-15-12:53:07 Johnathon Day:
>    If someone on the SELinux team sees any mistakes in what I'm saying,
> feel free to correct me.

I'm not on the selinux team, but I see an assumption you're making
that needs to be hauled out and examined clearly.

You're assuming that control mechanisms wired into selinux can be
effective. This is true only as long as the selinux installation
itself isn't modified or replaced by something else.

The original poster seemed to be describing a setting where the
physical hardware on which the OS was running was left exposed in a
public lab. If that were the case, then no OS protections could
solve the resulting security problem; before OS design can be of any
help, the hardware itself must be physically secured enough to
prevent the attacker from simply replacing it.

That's why replies emphasized tricks like rigging a bootable CD to
carry with you.

>    SELinux, as I understand it, uses mandatory access controls. To me,
> this implies that NO user, including the superuser, has automatic right
> of access, except in those specific cases where access is explicitly 
> granted. ie: the default is to deny access.

That's all fine --- as long as selinux is running, and the OS itself
hasn't been compromised. With physically unprotected hardware, that
cannot be guaranteed.

-Bennett

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]